I-Worm.Bagle.B
Symptom #1: 'Subject' is 'ID <abra-kadabra>...
thanks'.
(<abra kadabra> is a sequence of random
characters)
Symptom #2: 'Body' is:
Yours ID <abra-kadabra>
--
Thank
(<abra kadabra> is a sequence of random
characters)
Symptom #3: The attachment
has a random name, with a file size of 11KB
I-Worm.Novarg (MyDoom)
Symptom #1: Has one of these subjects:
test
hi
hello
Mail Delivery System
Mail Transaction Failed
Server Report
Status
Error
Symptom #2: Has one
of these bodys:
test
The message cannot be represented
in 7-bit ASCII encoding
and has been sent as a binary attachment.
The message contains Unicode
characters and has been sent
as a binary attachment.
Mail transaction failed. Partial
message is available.
Symptom #3: Attached
file has one of these names:
document
readme
doc
text
file
data
test
message
body
Symptom #4: The attachment
may have one of the following extensions:
pif
scr
exe
cmd
bat
I-Worm.Mimail.i
Symptom #1: 'From' is: donotreply@paypal.com
Symptom #2: 'Subject'
is: YOUR PAYPAL.COM ACCOUNT EXPIRES
Symptom #3: 'Body'
is:
Dear PayPal member,
PayPal would like to inform you about some important
information regarding your PayPal account. This
account, which is associated with this email address
will be expiring within five business days. We
apologize for any inconvenience that this may
cause, but this is occurring because all of our
customers are required to update their account
settings with their personal information.
We are taking these actions because we are implementing
a new security policy on our website to insure
everyone's absolute privacy. To avoid any interruption
in PayPal services then you will need to run the
application that we have sent with this email
(see attachment) and follow the instructions.
Please do not send your personal information through
email, as it will not be as secure.
IMPORTANT! If you do not update your information
with our secure application within the next five
business days then we will be forced to deactivate
your account and you will not be able to use your
PayPal account any longer. It is strongly recommended
that you take a few minutes out of your busy day
and complete this now.
DO NOT REPLY TO THIS MESSAGE VIA EMAIL! This mail
is sent by an automated message system and the
reply will not be received.
Thank you for using PayPal.
Symptom #4: Has attachment:
donotreply@paypal.com
I-Worm.Sober
Symptom #1: Has one of these subjects:
You send spam mails (Worm?)
A worm is on your computer!
Now, it's enough
You have sent me a virus!
Hi darling, what are you doing now?
Be careful! New mail worm
Re: Contact
RE: Sex
Sorry, I've become your mail
Hey man, long not see you
Re: lol
Viurs blocked every PC (Take care!)
Surprise
I've become your mail!
Advise who I am!
New Sobig-Worm variation (please read)
Back At The Funny Farm
I love you (I'm not a virus!)
Neuer Virus im Umlauf!
Sie versenden Spam Mails (Virus?)
Ein Wurm ist auf Ihrem Computer!
Langsam reicht es mir
Sie haben mir einen Wurm geschickt!
Hi Schnuckel was machst du so ?
VORSICHT!!! Neuer Mail Wurm
Re: Kontakt
RE: Sex
Sorry, Ich habe Ihre Mail bekommen
Hi Olle, lange niks mehr geh
Re: lol
Viurs blockiert jeden PC (Vorsicht!)
_berraschung
Ich habe Ihre E-Mail bekommen !
Jetzt rate mal, wer ich bin !?
Neue Sobig Variante (Lesen!!)
Back At The Funny Farm
Ich Liebe Dich
Symptom #2: Attached
file has one of these names:
AntiVirusDoc.pif
Check-Patch.bat
Screen_Doku.scr
Removal-Tool.exe
Perversionen.scr
Bild.scr
robot_mail.scr
RobotMailer.com
Privat.exe
AntiTrojan.exe
Mausi.scr
NackiDei.com
Anti-Sob.bat
screen_doc.scr
potency.pif
perversion.scr
pic.scr
CM-Recover.com
playme.exe
robot_mailer.pif
little-scr.scr
security.pif
Funny.scr
Liebe.com
Odin_Worm.exe
anti_virusdoc.pif
check-patch.bat
removal-tool.exe
love.com
nacked.com
Hengst.pif
schnitzel.exe
anti-trojan.exe
NAV.pif
I-Worm.Sobig.f
Symptom #1: Has one of these
subjects:
Re: That movie
Re: Wicked screensaver
Re: Your application
Re: Approved
Re: Re: My details
Re: Details
Your details
Thank you!
Re: Thank you!
Symptom #2: Message
body has these strings:
See the attached file for details
Please see the attached file for details.
Symptom #3: Attached
file has one of these names:
movie0045.pif
wicked_scr.scr
application.pif
document_9446.pif
details.pif
your_details.pif
thank_you.pif
document_all.pif
your_document.pif
I-Worm.Mimail
Symptom #1: 'From' field looks like:
"admin@%email" , where %email is always
different email address
Symptom #2: 'Subject'
field has: "your account %string", where
%string is always different string
Symptom #3: Body of
message looks like:
"Hello there,
I would like to inform you about
important information regarding your email address.
This email address will be expiring.
Please read attachment for details.
---
Best regards, Administrator
---
"
Symptom #4: 'message.zip'
file attached. It contains infected 'message.html'
file.
I-Worm.Klez
Symptom #1: 'Subject' is randomly selected
string from this list:
Hello
How are you?
Can you help me?
We want peace
Where will you go?
Congratulations!!!
Don't cry
Look at the pretty
Some advice on your shortcoming
Free XXX Pictures
A free hot porn site
Why don't you reply to me?
How about have dinner with me together?
Never kiss a stranger
Symptom #2: Has following
body text:
" I'm sorry to do so,but it's helpless to
say sory.
I want a good job,I must support my parents.
Now you have seen my technical capabilities.
How much my year-salary now? NO more than $5,500.
What do you think of this fact?
Don't call my names,I have no hostility.
Can you help me?"
I-Worm.Tanatos.a (Bugbear.a)
Symptom #1:Subject is one of the following
strings:
Greets!
Get 8 FREE issues - no risk!
Hi!
Your News Alert
$150 FREE Bonus!
Re:
Your Gift
New bonus in your cash account
Tools For Your Online Business
Daily Email Reminder
News
free shipping!
its easy
Warning!
SCAM alert!!!
Sponsors needed
new reading
CALL FOR INFORMATION!
25 merchants and rising
Cows
My eBay ads
empty account
Market Update Report
click on this!
fantastic
wow!
bad news
Lost & Found
New Contests
Today Only
Get a FREE gift!
Membership Confirmation
Report
Please Help...
Stats
I need help about script!!!
Interesting...
Introduction
various
Announcement
history screen
Correction of errors
Just a reminder
Payment notices
hmm..
update
Hello!
Symptom #2: Attached
file name is randomly selected and may have 'double
extension'. Example: file.DOC.SCR
I-Worm.Swen
Symptom #1: Looks as it have been sent
from Microsoft Services (Microsoft Internet Security
Section, MS Technical Assistance).
Symptom #2: Message
content suggests users to install a "special
patch" from Microsoft. This "patch"
(virus body) is attached to message.
"Webber" trojan
Symptom #1: "Webber" message has the
following subject line: "Re: Your credit
application"
Symptom #2: Body text in English,
includes file attachment named "web.da.us.citi.heloc.pif".
Virus File launches if user clicks on 'confuse'-web
address.
